13 ms·
PayPal and Venmo are still letting SIM swappers hijack accounts
- tpmx 7y agoThere should be a well-known website with a neat domain name that lists well-known companies that allow this to continue to happen.
- tpmx 7y ago> Paypal So my instinctual habit of adding and then deleting my credit card details whenever I need to do a Paypal payment was correct, after all...
- maallooc 7y agoMy account was abused because of SIM swap. It was banned. I explained them that I did not do it. They won't budge. We need to enforce tech companies to have proper customer support. We need to make a regulation that enables users to appeal or sue tech companies decision about their account. No more 'fix through hacker news submission or reply' please.
- toomuchtodo 7y agoThe term you're looking for is an "Ombudsman". https://en.wikipedia.org/wiki/Ombudsman https://en.wikipedia.org/wiki/Ombudsman
- TheChaplain 7y agoIt's a great idea as long as they have teeth to make shady businesses fear them.
- eqtn 7y agoWe just need a law stating that if a website cross certain number of active users(registered) in a country they should have physical customer care offices. When they reach 10m,they should have it in every district(just like phone service centers). Its nice to think about this although these companies are rich and can lobby against these kind of laws.
- valuearb 7y agoYep, because more laws solve every problem without unintended side effects! Or, just hear me out, you could stop using services that don’t meet your high customer support standards?
- __s 7y agoTheir suggestion is a bit far reaching, but their point is that eventually the user count of a service reaches a point where due to network effects individuals aren't able to effectively shop around
- adjkant 7y agoAgreed completely. I think it's quite easy to imagine that a virtual version of this law could be enacted to require that they actually deal with these situations in a timely manner.
- Eldt 7y agoSo what, keep trying different services and getting burned until... eventually... you don't get burned?
- stronglikedan 7y ago> and getting burned until... eventually... you have nothing left to burn
- RHSeeger 7y agoI'm not entirely sure that not allowing them to just close your account, never talk to you again, and walk away with your money is "high customer support standards".
- cortesoft 7y agoEvery district? I think you underestimate how big a country like the United States is, and how few 10 million users are for web sites. Facebook has one of the highest revenue per user at $7 a year... so 10 million users would get them about $70 million in revenue a year.. take a phone company like Verizon... they have 2300 stores in the US.... if our hypothetical web company opened up 2300 stores, they would only have $30k per store... and that is just revenue, not taking into account any other expenses. If they had zero other expenses and just ran the offices, they wouldn’t even be able to hire one worker for each store....
- AnthonyMouse 7y agoPaypal is less of a tech company and more of a finance company. This kind of behavior is caused by rules that put the cost of fraud on the payment processor rather than the customer, even though the payment processor's primary tools to prevent it basically involve locking the customer's account based on vague suspicion and hearsay. When someone has stolen your identity, there isn't really anything you can tell someone to prove you're you. Having your password or SSN or access to your email or the answers to your security questions tell them nothing. The perpetrator could have those things. Your account may have been created by the perpetrator to begin with and the person whose name is on it has never even used their service. How are they supposed to tell? Even if you're you, the perpetrator may still have access to whatever method was used to access your account to begin with and if they turned it back on there would be more fraud (which causes the payment processor to lose money instead of you). So your account is locked forever and you can pound sand. The alternative to people getting locked out of their accounts is having accounts without reversible transactions. You don't want this for your brokerage account, but you do want it for the account you're using to buy things with petty cash. Because then the account never has more than $1000 in it to begin with, which limits your losses to that amount, but then the payment processor doesn't have any incentive to ban your account because the losses are yours. If you're careless and reuse passwords, you might lose the $1000, but you don't get banned forever from making financial transactions. Then you learn your lesson and do better next time. That would also result in lower transaction fees, because most of the transaction fees go to paying the cost of fraud protection. And it would reintroduce the incentive to prevent fraud to the people best situated to do that (stop reusing passwords, people), so there would also be less fraud, which is better for everybody.
- zxcvbn4038 7y agoPayPal is the worst - a couple days ago they disabled my password (including both 2FAs) and sent me an e-mail asking me to reset it. The only way to reset it is via SMS which I don’t do. I’m locked out of my account now and also support now since the only way to contact them is by logging in. I’m hoping Synchrony has an in with them because I have balances on PayPal MasterCard and PayPal line of credit that can only be accessed by logging in.
- latchkey 7y agoTo be clear, Paypal owns Venmo.
- wronglebowski 7y agoIs there a recommended defense against a SIM Swap attack at the carrier level? Do carriers offer some form of two factor? I suppose the weakest link is the in store associate who just can't be bothered to verify identities.
- kube-system 7y agoSome carriers have security questions they are supposed to ask before making changes to an account. Not sure how well these actually work in practice.
- imglorp 7y agoThere should be an explicit lock like there is for credit agencies.
- dabernathy89 7y agoYes, you can add additional security onto your account - at least with Verizon. I highly encourage everyone to do so. Once enabled, you will need to present photo ID at a corporate Verizon store to allow your phone # to be transferred to a new carrier. Instructions: https://twitter.com/ramsey/status/1235227940054585344 https://twitter.com/ramsey/status/1235227940054585344 My wife got SIM jacked just a few weeks ago and we got extremely lucky that it didn't turn into a bigger problem. They did get a hold of her Venmo account, but fortunately it's not actually linked to our bank account (Venmo restricts the # of users that can link to a single bank account).
- deleted 7y ago[deleted]
- dguo 7y agoThanks for the tip! I'm glad to see they've implemented this. Though I'm still very frustrated about how long it took for them to do anything about this problem.
- jtokoph 7y agoThis doesn’t work because many SIM swaps are now done with stolen corporate credentials or bribed retail employees. They login to the corporate portal and check the box that says “I verified the customer’s ID” and proceed with the sim swap. This only protects you from the old way where a scammer tries to convince well intentioned phone support or retail employees.
- Finnucane 7y agoI try to avoid having my phone linked to accounts as much as I can. When the web sites say, "add your phone" I say "no."
- NullPrefix 7y agoIIRC, gmail says no too and you are left without an email address.
- Finnucane 7y agoNo, _you_ are left without an email address. I don't use gmail.
- dividuum 7y agoAgreed. Especially if it's unclear whether or not that's used for any kind of magical and probably broken account recovery process. I have to click through the Paypal "give me your phone number" question every time I log in... It sucks.
- pengaru 7y agoSame here, but disturbingly some sites are making it a requirement. The Match Group dating sites like Plenty of Fish and OkCupid recently made it a hard requirement to setup a 2FA phone number, even for existing accounts. It's a super annoying trajectory, and I imagine potentially dangerous if one considers the dating sites and victims of abusive relationships attempting to get out. Making physical access to the phone all one needs to gain access to a dating profile is a clear regression from unsaved passwords.
- nexuist 7y agoWithout any form of national ID it's a really hard problem to solve. As someone who runs my own login system, I require phone numbers to prevent botting. Obviously you can make a bot through Twilio etc, but it becomes economically nonviable to mount attacks through bot registration, which is my goal.
- dabernathy89 7y agoThis is the recommended solution: > The easiest way to make it impossible for SIM swappers to take over your accounts after they hijack your number is to unlink your phone number with those accounts, and use a VoIP number—such as Google Voice, Skype, or another—instead. They don't mention that some carriers offer the ability to secure your account against unauthorized transfers, but it's opt-in. Here's how you can do it on Verizon: https://twitter.com/ramsey/status/1235227940054585344 https://twitter.com/ramsey/status/1235227940054585344
- hasham11 7y agoThe problem with using a VOIP number is that most app and websites won't let you use anything but a regular carrier number for verification -- they specifically restrict VOIP numbers from use. I presume this is to prevent spammers or just regular users from creating multiple accounts, but I think they're mistaken as it's trivial to buy a temporary "real" carrier number on the internet if you're fine using a somewhat-shady site.
- toast0 7y agoI've been the person at the app banning voip numbers. The problem is there are some services that make it very easy to obtain a voip number at no cost to the user; if they don't have effective protections against bulk registration, spammers abuse them to get thousands of numbers and then use those numbers to abuse the service I was at. Forcing spammers to have a non-voip number raises their costs, sometimes significantly, reducing their ROI and their interest in spamming our users. We tried to make exceptions where we could, but it does suck for real people using voip numbers for whatever reasons.
- KingMachiavelli 7y agoHow can an arbitrary number be used to abuse your service? At least for SMS "2FA" you only need to be able to send a message to an number associated with an existing account. As long as you aren't using SMS as your rate limiting step to aquire an account then then it doesn't matter if someone has 1 phone number or 1000 numbers. In the case that SMS verification is the rate limiting step, why not switch to an open captcha or similir system?
- jlebar 7y agoPayPal / Venmo also don't have support for proper security keys. :(
- fuzzy2 7y agoPayPal supports Symantec tokens though? They even sold hardware tokens in the past.
- caymanjim 7y agoWhile SIM swapping is certainly a concern, this article makes it sound like it's universally bad to rely on phones as a form of authorization. What are the alternatives? I'd argue that email is far riskier; it's more commonly compromised, easier to compromise, and less visible when compromised. Ideally, users employ more secure 2FA methods like TOTP apps or dongles, but it's like pulling teeth to get anyone to adopt those. Relying on SMS in addition to email is better than relying on either one in isolation. I don't think I agree that Google Voice numbers are necessarily harder to hijack, because to do that they just need access to your Google login (typically your email credentials). There are risks all around, but this article doesn't offer any good solution that customers are likely to adopt in meaningful numbers. Maybe PayPal and other companies should require people to use secure 2FA, but they'd lose too much business.
- rabuse 7y agoTOTP apps are fine, if they're properly implemented (either completely on-device, or properly encrypted before stored in cloud). Services should properly implement account restoration codes if access to TOTP secret is lost. SMS should never be used for 2FA, ever.
- WorldMaker 7y agoThere are some apps that if my TOTP secret is lost, as horrifyingly annoying as it would be, I'd much rather need to take the time to get a registered public notary to stamp that they saw me in person, and checked my ID or other such documents, before the account recovery process can begin. The "old ways" are usefully slow, have protections built around them for centuries of our culture, and I'd rather the annoying administrative headache and "slow" over the quick abuse of account recovery systems for theft and fraud.
- Mirioron 7y agoEmail might get compromised more often, but that's usually due to some kind of user error. The problem with these sim swapping attacks is that the only way as a user to guard against this is not to give the company your phone number. This often means that you can't do 2FA.
- zxcvbn4038 7y agoCapitalOne is even worse -they locked me out of their app today and asked to send an SMS code - and they let you pick which number to send it to on the spot. Good one fellas. What is the point of having Touch ID and their dumb Swift ID stuff set up if they keep doing dumb stuff like this.
- ThePowerOfFuet 7y agoWhy haven't you gotten the hell out then?
- csomar 7y agoHonestly, what is a good US bank that has a great web/mobile experience, a large financial offering (checking, credit, savings, investment, etc...), great customer support, a good presence internationally, reasonable and no hidden fees.. wait there is none.
- choward 7y agoIt's the same bank that doesn't send you spam emails which make you used to receiving unsolicited communication from your bank. These emails make it easier to sneak in phishing emails. That's why I use that bank.
- enjo 7y agoUSAA fits that bill for me.
- SkyMarshal 7y agoIsn't USAA restricted to military or spouse/child of military?
- lcall 7y agoFor insurance and banking I think, but not for investing and maybe some other services, it seems.
- dang 7y agoThe article this is pointing to was discussed here: https://news.ycombinator.com/item?id=22687927 https://news.ycombinator.com/item?id=22687927 and the study here: https://news.ycombinator.com/item?id=22016212 https://news.ycombinator.com/item?id=22016212
- mikece 7y agoIt is annoying that some of these companies refuse to allow me to use a Twilio number when they insist on using SMS as 2FA. If they are going to insist on the weakest possible form of 2FA and INSIST that I use a number which is subject to SIM hijacking, how are they not liable through negligence?
- stqism 7y agoThis is because these companies use APIs to establish trust for numbers which do so using a combination of proprietary telco data, machine learning models, and reports from customers. voip numbers like twilio and google voice are a surprisingly large source of fraud, so often the recommendation returned is to block based on how risk adverse the company is. This method is highly effective at reducing fraud at the cost of penalizing a minority of legitimate users who actually do have to use Google voice / etc. It should be noted though that factors like why is this number being looked up are considered too, ie: OTP is less risky than say account creation at a bank.
- TwoBit 7y agoCan't Google Voice numbers be outside the US? I've read of foreigners trying to take over Google Voice numbers so they can use them like they are in US.
- Raphaellll 7y agoThis was (is?) also possible with Lyft. When I was interning in the US, my visa sponsor sent me a SIM card that they clearly reused several times a year. Opening the Lyft app with this SIM automatically logged me in to the attached account. I didn’t noticed this and took a 70$ trip from SF to SV. Next morning I realized it wasn’t my account and credit card details. Wrote to Lyft support but never heard back. It wasn’t even possible to log out of this account and create a new one.
- jedberg 7y agoLyft probably decided it was cheaper to eat the $70 than admit this attack vector exists.
- deleted 7y ago[deleted]
- choward 7y agoWhy isn't there more of an emphasis on the phone companies? They're the ones literally giving your phone number to someone else.
- kome 7y agocan we please stop using cellphones and smartphone for anything serious please?
- ppf 7y agoOddly enough, today I finally had to give my mobile number to paypal - apparently due to incoming EU PSD2 regulations. I was also automatically signed up to paypal "one touch", where my device is now able to make transactions with no need for a password. Another thing I have to turn off.
- dheera 7y ago2FA should never be SMS based. I've deprecated SMS for all communications and block all SMS messages to my phone. I use a virtual number for all such services that demand an idiotic SMS verification code. I won't state which one I use here, but there are several services you can choose from that provide virtual numbers.
- exabrial 7y agoPlease stop supporting sms for 2FA. It's not better than nothing, it's worse than nothing. Given the extent of technology workers on hacker news please work to remove this antipattern from your products.
- wtallis 7y agoThe problem is that the SMS is being used not to implement 2FA, but 1/2FA where you can get into the account with just one of the two factors, rather than requiring both.
- renewiltord 7y agoI think if you use Google Fi, then you can lock down your account pretty well and you'll need your hardware key to change things.
- jonny383 7y agoPayPal is legitmately the biggest piece of crap flying around the internet. I'm amazed they are still a thing, given the sheer number of stories we all hear about "PayPal stole my 10k and wouldn't give it back for months" and then, this. It's been such a relief to stay in SE asia for sometime where PayPal isn't associated with all kinds of online shopping. I can actually order online AND be given the choice to either pay online OR in person in cash. PayPal and it's crappy culture needs to die.